> > AFAICT, it verifies userspace _and_ kernel memory, that's why it does> > magic stack switching. Why not verify everything in tboot?> Because tboot only can access <4G mem without paging. And the memory is sparse. We can't/needn't set unlimited sparse mem ranges to the MAC array with limited elements in the shared page, in order to pass the parameters.> On the other hand, it is reasonable for tboot to verify kernel, and kernel to verify userspace memory.>

> >> +static vmac_t mem_mac;> >> +static struct crypto_hash *tfm;> > > > Could these be automatic?> Maybe, but I don't wish other files can access the variables and take tfm as an example, I'd like to allocate memory to it once and then initialize it once in order to avoid impact of memory change to MACing.>